Privacy Notice

1. Introduction

This Notice applies to Nomyx Technology Labs Inc. and its relevant Affiliates listed in Section 14 ("Nomyx," "us," "we," or "our"). Capitalized terms that we use but are not defined in the Notice (such as Site, Services, Subscriber, Agent, Agent Contact Information, etc.) have the meaning provided in our Main Services Agreement. If you are located in the European Economic Area ("EEA"), Switzerland, or the United Kingdom ("U.K."), please refer to Section 11 of this Notice for more information about which specific entity or entities act as a controller of your personal data.

When Does This Notice Apply? This Notice only applies to personal data that Nomyx handles as a Controller (meaning where Nomyx controls how and why your personal data is processed). This includes when you:

• Visit or interact with the Nomyx.io Site, the Nomyx mobile applications, the Nomyx Marketplace, the Nomyx Developer Portal, our branded social media pages, and other Sites which we operate (collectively, our "Digital Properties");
• Register for or participate in our webinars, events, programs, marketing, and promotional activities;
• Interact with us in person, such as when you visit our offices;
• Inquire about or engage in commercial transactions with us;
• Register for or participate in tokenized securities offerings through our platform;
• Complete investor verification processes for securities transactions;
• Interact with our securities tokenization services;
• Submit documentation for accredited investor verification; and
• Use our blockchain interfaces or smart contract deployment tools.

Changes: We may update this Notice from time to time. Please check back periodically for updates. If you do not agree with any changes we make, you should stop interacting with us. When required under applicable law, we will notify you of any changes to this Notice by posting an update on our Site or in another appropriate manner.

2. Personal Data We Collect and Disclose

3. How We Process Personal Data

We may process your personal data for the below purposes:

• To provide our products, Services, and Digital Properties: Including processing transactions, enabling access, operating and improving services, communicating with you, and diagnosing issues. Lawful Basis: Legitimate interests; Contract; Legal obligations
• To facilitate securities tokenization: Including verifying investor accreditation, processing securities transactions, maintaining cap tables, distributing payments, and enforcing transfer restrictions. Lawful Basis: Contract; Legal obligations; Legitimate interests
• For regulatory compliance: Including SEC reporting, FINRA compliance, AML/KYC verification, sanctions screening, and maintaining required records. Lawful Basis: Legal obligations; Public interest
• To operate blockchain infrastructure: Including deploying smart contracts, processing transactions, managing digital wallets, and maintaining network nodes. Lawful Basis: Contract; Legitimate interests
• For our own business purposes: Including maintaining records, collecting payments, auditing, IT management, and research and development. Lawful Basis: Legitimate interests; Legal obligations
• For legal, safety, or security reasons: Including compliance, legal claims, protecting rights, investigating violations, and preventing illegal activity. Lawful Basis: Legitimate interests; Legal obligations; Public interest
• For marketing: Including testimonials, communications, recommendations, and contests. You may opt out via unsubscribe links. Lawful Basis: Consent (where required); Legitimate interests
• To fulfill referral requests: When you use our referral service. You must only provide others' data with their consent. Lawful Basis: Consent (where required); Legitimate interests
• Diversity, equity, and inclusion initiatives: Where authorized by law. Lawful Basis: Consent (where required); Legitimate interests
• Corporate transactions: Such as mergers, acquisitions, or reorganizations. Lawful Basis: Legitimate interests; Legal obligations
• When you have voluntarily agreed: To have your personal data processed. Lawful Basis: Consent

4. Sources of Personal Data

• Information you provide directly, including registrations, communications, office visits, and event participation
• Information from verification providers, including Persona (identity verification) and other compliance services
• Information collected from your employer, coworkers, or friends
• Information automatically collected, including technical information about your interactions

5. Cookies and Tracking Technologies

We use cookies and other tracking technologies as described in our Cookie Notice. Some tracking technologies enable us to track your device activity over time and across devices and websites. While some browsers have incorporated Do Not Track preferences, we do not honor such signals at this time.

We use additional tracking for blockchain services:

• Wallet connection tracking
• Transaction monitoring cookies
• Smart contract interaction analytics
• Compliance monitoring tools

These are essential for security and cannot be disabled while using tokenization services.

6. Security and Retention

We maintain enterprise-grade security measures including:

• Multi-factor authentication requirements
• Regular third-party security audits
• Dedicated security for securities data

Securities Data Retention:

• KYC/AML records: 5 years after relationship ends
• Securities transaction records: 7 years minimum

7. Children's Privacy

Our Sites and Services are not directed to children under the age of 16, and we do not knowingly collect online personal data directly from children. If you are a parent or guardian of a minor child and believe that the child has disclosed online personal data to us, please contact us.

8. External Links

When interacting with us, you may encounter links to external sites or other online services. We do not control and are not responsible for privacy and data collection policies for such third-party sites and services.

9. Contact Information

If you have questions or complaints regarding this Notice or about the Nomyx Group's privacy practices, please contact us:

Email Contacts:

• General Privacy: legal@nomyx.io
• Securities Compliance: compliance@nomyx.io
• Data Deletion Requests: legal@nomyx.io
• Regulatory Inquiries: legal@nomyx.io
• Security Incidents: security@nomyx.io (24/7)

Mailing Address:
Nomyx Technology Labs Inc.
Attn: Privacy Team
16192 Coastal Highway
Lewes, Delaware 19958, United States

10. Supplemental Terms for California Residents

Pursuant to the California Consumer Privacy Act ("CCPA"), this Section applies to certain personal data collected about California individuals where Nomyx controls how and why the personal data is processed.

11. Supplemental Information for the EEA, Switzerland, and the U.K.

12. Supplemental Information for Other Regions

• Australia: Personal data is collected, stored, used, and/or processed in accordance with the Australian Privacy Act 1988 (Commonwealth) and the Australia Privacy Principles. Complaints may be made to the Office of the Australian Information Commissioner ("OAIC").
• Brazil: Personal data is collected, stored, used, and/or processed in accordance with Lei Geral de Proteção de Dados ("LGPD").
• Canada: Personal data will be collected, stored, used, and/or processed in accordance with the Personal Information Protection and Electronic Documents Act ("PIPEDA").
• Japan: Personal data is collected, stored, used, and/or processed in accordance with Japan's Act on the Protection of Personal Information ("APPI").
• Nevada: We do not presently sell personal data as defined under Nevada law. Nevada residents may email us to exercise their right to opt-out of sale under Nevada Revised Statutes §603A et seq.
• New Zealand: Personal data is collected, stored, used, and/or processed in accordance with New Zealand's Privacy Act 2020 and its 13 Information Privacy Principles ("NZ IPPs").
• Singapore: Personal data is collected, stored, used, and/or processed in accordance with the Personal Data Protection Act 2012 ("PDPA").
• United Kingdom: Personal data is collected, stored, used, and/or processed in accordance with the UK Data Protection Act 2018 ("U.K. GDPR").

13. Securities Regulatory Compliance

When using our tokenization services, your data may be processed for:

• SEC regulatory reporting
• FINRA compliance requirements
• FinCEN anti-money laundering rules
• State securities law compliance
• International securities regulations

We may disclose data to regulators without notice when required by law or legal process. Contact compliance@nomyx.io for regulatory data questions.

14. Transparency and Control

15. Revision History & Version Control